Dependency updates (Renovate)

Renovate opens the dependency-bump PRs for this repo. Config lives in .github/renovate.json5 and is the source of truth — change it there, not in the Renovate UI.

What is in scope

GitHub Actions only. enabledManagers is set to github-actions, so Renovate looks at .github/workflows/** and .github/actions/** and nothing else. pnpm, Dart/pub, Terraform and Docker updates are still manual on purpose; widening the scope means adding the manager to enabledManagers in a PR of its own, so the review noise lands one ecosystem at a time.

The rules

Setting	Value	Why
minimumReleaseAge	30 days	Nothing newer than 30 days old. Gives the ecosystem time to yank or patch a bad (or compromised) release before it reaches our CI. internalChecksFilter: strict makes sure the age check is never skipped.
baseBranchPatterns	develop	PRs target develop, like any other change. main only ever receives release/hotfix branches.
helpers:pinGitHubActionDigests	on	Third-party actions stay pinned to a commit SHA with a # vN comment. Renovate bumps the SHA and the comment, and pins any tag it finds (a few @v4/@v6 remain).
Grouping	one PR for minor/patch/digest, one PR per major	A weekly grouped PR keeps the noise down; majors land alone so a breaking action change is easy to spot and revert.
schedule	before 07:00 Monday	Bumps arrive as one batch at the start of the week.
Limits	3 open PRs, 2/hour	Renovate can't flood the queue or the Blacksmith runners.

Commits come out as ci(deps): ..., which satisfies commitlint (any scope is allowed). Renovate branches are renovate/* and carry no PPL key, so the Jira sync workflows log "No PPL issue key found" and skip — expected, not a failure.

Reviewing a Renovate PR

Same bar as any other PR: one approval and the required checks (Backend checks passed / Flutter checks passed) green. Renovate PRs that touch ci-flutter.yml or a Flutter composite action run the full Flutter matrix; the rest pass through the path-filter gate quickly. Read the release notes in the PR body before approving — the age delay reduces risk, it doesn't remove it.

Turning it on / off

Renovate runs as the GitHub App on the percihealth org. If PRs stop arriving, check the app is still installed on this repo and look at the Dependency Dashboard issue, which lists everything Renovate is holding back (including updates still inside the 30-day window).